@opengeni/db 0.28.9 → 0.31.1

package/dist/chunk-ISI2TIUG.js

@@ -0,0 +1,639 @@
+import {
+  LOSSLESS_CONTENT_WRITER_APPLICATION_NAME,
+  schema_exports,
+  sessions,
+  workspaceSessionActivityRevisions,
+  workspaces
+} from "./chunk-MWDVXQOL.js";
+
+// src/persistence-errors.ts
+var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
+var NESTED_ERROR_KEYS = ["cause", "original", "driverError", "error", "errors"];
+var DATABASE_ERROR_NAMES = /* @__PURE__ */ new Set(["DatabaseError", "DrizzleQueryError", "PostgresError"]);
+var DATABASE_DIAGNOSTIC_KEYS = [
+  "severity",
+  "schema_name",
+  "table_name",
+  "column_name",
+  "data_type_name",
+  "constraint_name",
+  "routine"
+];
+var SAFE_FACT_KEYS = [
+  ["severity", "severity"],
+  ["schema_name", "schema"],
+  ["schema", "schema"],
+  ["table_name", "table"],
+  ["table", "table"],
+  ["column_name", "column"],
+  ["column", "column"],
+  ["data_type_name", "dataType"],
+  ["dataType", "dataType"],
+  ["constraint_name", "constraint"],
+  ["constraint", "constraint"],
+  ["routine", "routine"]
+];
+function isRecord(value) {
+  return Boolean(value && typeof value === "object");
+}
+function safeFact(value) {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  return value;
+}
+function nestedPostgresSqlState(error) {
+  const queue = [error];
+  const seen = /* @__PURE__ */ new Set();
+  let fallback = null;
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!isRecord(current) || seen.has(current)) continue;
+    seen.add(current);
+    for (const key of SQLSTATE_KEYS) {
+      const value = current[key];
+      if (typeof value !== "string" || !/^[0-9A-Z]{5}$/i.test(value)) continue;
+      const normalized = value.toUpperCase();
+      if (normalized === "40P01" || normalized === "40001") return normalized;
+      fallback ??= normalized;
+    }
+    for (const key of NESTED_ERROR_KEYS) {
+      const nested = current[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== void 0) queue.push(nested);
+    }
+  }
+  return fallback;
+}
+function databaseFailureCode(sqlState) {
+  if (sqlState === "40P01") return "db_deadlock";
+  if (sqlState === "40001") return "db_serialization_failure";
+  return "db_failure";
+}
+function isRetryablePersistenceSqlState(sqlState) {
+  return sqlState === "40P01" || sqlState === "40001";
+}
+function isDatabasePersistenceFailure(error) {
+  if (nestedPostgresSqlState(error) !== null) return true;
+  const queue = [error];
+  const seen = /* @__PURE__ */ new Set();
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!isRecord(current) || seen.has(current)) continue;
+    seen.add(current);
+    if (typeof current.name === "string" && DATABASE_ERROR_NAMES.has(current.name)) {
+      return true;
+    }
+    if (typeof current.query === "string" && (Object.hasOwn(current, "params") || Object.hasOwn(current, "parameters"))) {
+      return true;
+    }
+    if (DATABASE_DIAGNOSTIC_KEYS.some((key) => Object.hasOwn(current, key))) {
+      return true;
+    }
+    for (const key of NESTED_ERROR_KEYS) {
+      const nested = current[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== void 0) queue.push(nested);
+    }
+  }
+  return false;
+}
+function safeDatabaseErrorFacts(error) {
+  const queue = [error];
+  const seen = /* @__PURE__ */ new Set();
+  const facts = {};
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!isRecord(current) || seen.has(current)) continue;
+    seen.add(current);
+    for (const [source, destination] of SAFE_FACT_KEYS) {
+      if (facts[destination] !== void 0) continue;
+      const value = safeFact(current[source]);
+      if (value !== void 0) facts[destination] = value;
+    }
+    for (const key of NESTED_ERROR_KEYS) {
+      const nested = current[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== void 0) queue.push(nested);
+    }
+  }
+  return facts;
+}
+var SessionEventPersistenceError = class extends Error {
+  constructor(details, cause) {
+    const label = details.code === "db_deadlock" ? "Database deadlock" : details.code === "db_serialization_failure" ? "Database serialization failure" : "Database failure";
+    const operation = `${label} while persisting ${details.eventTypes.join(", ") || "session events"}`;
+    super(operation, cause === void 0 ? void 0 : { cause });
+    this.details = details;
+  }
+  name = "SessionEventPersistenceError";
+  get code() {
+    return this.details.code;
+  }
+};
+function isSessionEventPersistenceError(error) {
+  return error instanceof SessionEventPersistenceError;
+}
+async function runIdempotentPersistenceTransaction(options, transaction) {
+  const maxAttempts = options.maxAttempts ?? 3;
+  if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+    throw new Error("Persistence maxAttempts must be a positive integer");
+  }
+  const correlationId = options.correlationId ?? crypto.randomUUID();
+  const eventTypes = [...new Set(options.eventTypes ?? [])].sort();
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    try {
+      return await transaction(attempt);
+    } catch (error) {
+      const sqlState = nestedPostgresSqlState(error);
+      const retryable = isRetryablePersistenceSqlState(sqlState);
+      if (retryable && attempt < maxAttempts) {
+        await options.onRetry?.({
+          attempt,
+          sqlState
+        });
+        continue;
+      }
+      if (!isDatabasePersistenceFailure(error)) throw error;
+      throw new SessionEventPersistenceError(
+        {
+          code: databaseFailureCode(sqlState),
+          sqlState,
+          stage: options.stage,
+          eventTypes,
+          correlationId,
+          attempts: attempt,
+          retryOutcome: retryable ? "exhausted" : "not_retryable",
+          database: safeDatabaseErrorFacts(error)
+        },
+        error
+      );
+    }
+  }
+  throw new Error("Unreachable persistence retry state");
+}
+
+// src/database.ts
+import { eq, sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+var dbBindings = /* @__PURE__ */ new WeakMap();
+function rlsStrategyFor(db) {
+  return dbBindings.get(db)?.rlsStrategy ?? "force";
+}
+async function rawRows(executor, query) {
+  const result = await executor.execute(query);
+  if (Array.isArray(result)) {
+    return result;
+  }
+  const rows = result.rows;
+  if (Array.isArray(rows)) {
+    return rows;
+  }
+  throw new Error("Unsupported database execute() result shape");
+}
+var SandboxProviderReadLockUnavailableError = class extends Error {
+  constructor() {
+    super("Sandbox provider reads are temporarily busy. Retry the request.");
+    this.name = "SandboxProviderReadLockUnavailableError";
+  }
+};
+var SANDBOX_PROVIDER_READ_LOCK_WAIT_MS = 15e3;
+var SANDBOX_PROVIDER_READ_LOCK_POLL_MAX_MS = 200;
+function sandboxProviderReadLockKey(identity) {
+  return [
+    "sandbox-provider-read",
+    identity.workspaceId,
+    identity.sandboxGroupId,
+    identity.leaseEpoch,
+    identity.instanceId
+  ].join(":");
+}
+async function waitForSandboxProviderReadLockPoll(delayMs, signal) {
+  if (signal?.aborted) {
+    throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+  }
+  await new Promise((resolve, reject) => {
+    let settled = false;
+    let timer;
+    const cleanup = () => signal?.removeEventListener("abort", abort);
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve();
+    };
+    const abort = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      cleanup();
+      reject(signal?.reason ?? new DOMException("The operation was aborted", "AbortError"));
+    };
+    timer = setTimeout(finish, delayMs);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+  });
+}
+async function withSandboxProviderReadLock(db, identity, signal, fn) {
+  const key = sandboxProviderReadLockKey(identity);
+  const deadline = Date.now() + SANDBOX_PROVIDER_READ_LOCK_WAIT_MS;
+  return await db.transaction(async (lockedDb) => {
+    let pollMs = 20;
+    while (true) {
+      if (signal?.aborted) {
+        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+      }
+      const [row] = await rawRows(
+        lockedDb,
+        sql`select pg_try_advisory_xact_lock(hashtextextended(${key}, 0)) as acquired`
+      );
+      if (row?.acquired === true) return await fn();
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) throw new SandboxProviderReadLockUnavailableError();
+      await waitForSandboxProviderReadLockPoll(Math.min(pollMs, remainingMs), signal);
+      pollMs = Math.min(pollMs * 2, SANDBOX_PROVIDER_READ_LOCK_POLL_MAX_MS);
+    }
+  });
+}
+function createDb(databaseUrl, options = {}) {
+  const client = postgres(databaseUrl, {
+    max: options.max ?? 10,
+    prepare: false,
+    idle_timeout: 30,
+    max_lifetime: 1800,
+    // `connection` carries per-session Postgres STARTUP parameters. `application_name`
+    // (always) aids server-side diagnostics; `search_path` (embedded only) is the
+    // supported, query-param-free way to scope a connection to a dedicated schema —
+    // postgres-js IGNORES a URL `?search_path=`. Unset searchPath → omit it so the
+    // server default (`public`) is unchanged for standalone.
+    connection: {
+      application_name: LOSSLESS_CONTENT_WRITER_APPLICATION_NAME,
+      ...options.searchPath ? { search_path: options.searchPath } : {},
+      ...options.isolationLevel ? { default_transaction_isolation: options.isolationLevel } : {}
+    }
+  });
+  const db = drizzle(client, { schema: schema_exports });
+  dbBindings.set(db, {
+    rlsStrategy: options.rlsStrategy ?? "force",
+    ...options.userLookup ? { userLookup: options.userLookup } : {}
+  });
+  return {
+    db,
+    close: async () => {
+      await client.end();
+    }
+  };
+}
+function registerDbBinding(db, binding) {
+  dbBindings.set(db, {
+    rlsStrategy: binding.rlsStrategy ?? "force",
+    ...binding.userLookup ? { userLookup: binding.userLookup } : {}
+  });
+}
+async function setRlsContext(db, context) {
+  if (typeof context.accountId !== "string" || context.accountId.trim() === "") {
+    throw new Error("setRlsContext: a non-empty accountId is required to establish an RLS context");
+  }
+  await db.execute(sql`select set_config('opengeni.account_id', ${context.accountId}, true)`);
+  await db.execute(
+    sql`select set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true)`
+  );
+  await db.execute(sql`select set_config('opengeni.lossless_content_writer', '1', true)`);
+  await db.execute(sql`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
+}
+async function readRlsContextSettings(db) {
+  const [settings] = await rawRows(
+    db,
+    sql`select
+      current_setting('opengeni.account_id', true) as account_id,
+      current_setting('opengeni.workspace_id', true) as workspace_id`
+  );
+  return {
+    accountId: settings?.account_id ?? "",
+    workspaceId: settings?.workspace_id ?? ""
+  };
+}
+async function assertRlsContextApplied(db, context) {
+  const applied = await readRlsContextSettings(db);
+  const expectedWorkspaceId = context.workspaceId ?? "";
+  if (applied.accountId !== context.accountId) {
+    throw new Error(
+      `RLS context not applied on the active backend: expected account ${context.accountId}, got "${applied.accountId}"`
+    );
+  }
+  if (applied.workspaceId !== expectedWorkspaceId) {
+    throw new Error(
+      `RLS context not applied on the active backend: expected workspace "${expectedWorkspaceId}", got "${applied.workspaceId}"`
+    );
+  }
+}
+async function restoreRlsContextSettings(db, settings) {
+  const [restored] = await rawRows(
+    db,
+    sql`select
+      set_config('opengeni.account_id', ${settings.accountId}, true) as account_id,
+      set_config('opengeni.workspace_id', ${settings.workspaceId}, true) as workspace_id`
+  );
+  if (restored?.account_id !== settings.accountId || restored.workspace_id !== settings.workspaceId) {
+    throw new Error("RLS context could not be restored after a nested scope");
+  }
+}
+async function withRlsContext(db, context, fn, transactionConfig) {
+  const restoreParentScope = isTransactionHandle(db);
+  return await db.transaction(async (tx) => {
+    const scoped = tx;
+    const parentScope = restoreParentScope ? await readRlsContextSettings(scoped) : null;
+    await setRlsContext(scoped, context);
+    await assertRlsContextApplied(scoped, context);
+    const value = await fn(scoped);
+    if (parentScope) await restoreRlsContextSettings(scoped, parentScope);
+    return value;
+  }, transactionConfig);
+}
+async function withDatabaseStatementTimeout(db, timeoutMs, fn) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("withDatabaseStatementTimeout requires a positive timeout");
+  }
+  const boundedTimeoutMs = Math.max(1, Math.floor(timeoutMs));
+  return await db.transaction(async (tx) => {
+    const scoped = tx;
+    await scoped.execute(
+      sql`select set_config('statement_timeout', ${`${boundedTimeoutMs}ms`}, true)`
+    );
+    return await fn(scoped);
+  });
+}
+async function rlsContextForWorkspace(db, workspaceId) {
+  const [row] = await db.select({ accountId: workspaces.accountId }).from(workspaces).where(eq(workspaces.id, workspaceId)).limit(1);
+  if (!row) {
+    throw new Error(`Workspace not found: ${workspaceId}`);
+  }
+  return { accountId: row.accountId, workspaceId };
+}
+async function withWorkspaceRls(db, workspaceId, fn, transactionConfig) {
+  return await withRlsContext(
+    db,
+    await rlsContextForWorkspace(db, workspaceId),
+    fn,
+    transactionConfig
+  );
+}
+function isTransactionHandle(db) {
+  return typeof db.rollback === "function";
+}
+async function assertSessionActivityGateEntry(db) {
+  if (!isTransactionHandle(db)) return;
+  const [gate] = await rawRows(
+    db,
+    sql`
+      select nullif(
+        current_setting('opengeni.session_activity_gate_state', true),
+        ''
+      ) as state
+    `
+  );
+  if (gate?.state === null || gate === void 0) {
+    throw new Error("Session activity commit gate must start at the outer transaction boundary");
+  }
+}
+async function beginSessionActivityGate(db, workspaceId) {
+  const [gate] = await rawRows(
+    db,
+    sql`
+      with current_gate as materialized (
+        select
+          nullif(current_setting('opengeni.session_activity_gate_state', true), '') as prior_state,
+          nullif(current_setting('opengeni.session_activity_gate_workspace_id', true), '') as prior_workspace_id
+      )
+      select
+        prior_state,
+        prior_workspace_id,
+        case
+          when prior_state is null
+            then set_config('opengeni.session_activity_gate_state', 'open', true)
+          else prior_state
+        end as effective_state,
+        case
+          when prior_state is null
+            then set_config('opengeni.session_activity_gate_workspace_id', ${workspaceId}, true)
+          else prior_workspace_id
+        end as effective_workspace_id
+      from current_gate
+    `
+  );
+  if (!gate) {
+    throw new Error("Session activity commit gate could not be opened");
+  }
+  if (gate.prior_state === null) {
+    return { db, owner: true };
+  }
+  if (gate.prior_state === "open" && gate.prior_workspace_id === workspaceId) {
+    return { db, owner: false };
+  }
+  throw new Error("Session activity commit gate is already owned by another transaction scope");
+}
+async function finalizeSessionActivityGate(db, workspaceId) {
+  await db.execute(
+    sql`select set_config('opengeni.session_activity_gate_state', 'preparing', true)`
+  );
+  await db.execute(sql`set constraints all immediate`);
+  await db.execute(
+    sql`set constraints sessions_activity_insert_commit_guard, sessions_activity_update_commit_guard deferred`
+  );
+  const [result] = await rawRows(
+    db,
+    sql`
+      with gate as materialized (
+        select set_config('opengeni.session_activity_gate_state', 'finalizing', true) as state
+      ),
+      pending as materialized (
+        select ${sessions.id}
+        from ${sessions}
+        cross join gate
+        where ${sessions.workspaceId} = ${workspaceId}
+          and ${sessions.activityRevisionPendingXid}
+            = pg_current_xact_id()::text::bigint
+      ),
+      advanced as (
+        update ${workspaceSessionActivityRevisions} as counter
+        set revision = counter.revision + 1
+        where counter.workspace_id = ${workspaceId}
+          and exists (select 1 from pending)
+        returning counter.revision
+      ),
+      stamped as (
+        update ${sessions} as session
+        set
+          activity_revision = advanced.revision,
+          activity_revision_pending_xid = null
+        from advanced
+        where session.workspace_id = ${workspaceId}
+          and session.activity_revision_pending_xid
+            = pg_current_xact_id()::text::bigint
+        returning session.id
+      ),
+      stats as materialized (
+        select
+          exists (select 1 from pending) as had_pending,
+          (select count(*)::integer from pending) as pending_count,
+          (select revision::text from advanced) as revision,
+          (select count(*)::integer from stamped) as stamped_count
+      ),
+      finalized as materialized (
+        select
+          had_pending,
+          pending_count,
+          revision,
+          stamped_count,
+          set_config('opengeni.session_activity_gate_state', 'finalized', true) as state
+        from stats
+      )
+      select had_pending, pending_count, revision, stamped_count
+      from finalized
+    `
+  );
+  if (!result) {
+    throw new Error("Session activity commit gate did not return a finalization result");
+  }
+  if (result.had_pending && result.revision === null) {
+    throw new Error("Workspace session activity counter is unavailable");
+  }
+  if (result.stamped_count !== result.pending_count) {
+    throw new Error("Session activity commit gate did not stamp every pending row");
+  }
+  await db.execute(
+    sql`set constraints sessions_activity_insert_commit_guard, sessions_activity_update_commit_guard immediate`
+  );
+}
+async function withSessionActivityRlsContext(db, context, fn, transactionConfig) {
+  await assertSessionActivityGateEntry(db);
+  return await withRlsContext(
+    db,
+    context,
+    async (scopedDb) => {
+      const gate = await beginSessionActivityGate(scopedDb, context.workspaceId);
+      const value = await fn(gate.db);
+      await assertRlsContextApplied(gate.db, context);
+      if (gate.owner) {
+        await finalizeSessionActivityGate(gate.db, context.workspaceId);
+      }
+      return value;
+    },
+    transactionConfig
+  );
+}
+async function withWorkspaceSessionActivityRls(db, workspaceId, fn, transactionConfig) {
+  return await withSessionActivityRlsContext(
+    db,
+    { ...await rlsContextForWorkspace(db, workspaceId), workspaceId },
+    fn,
+    transactionConfig
+  );
+}
+async function withSessionActivitySavepoint(db, fn) {
+  return await db.transaction(async (tx) => await fn(tx));
+}
+async function retrySessionActivityRls(db, workspaceId, options, fn) {
+  return await runIdempotentPersistenceTransaction(options, async () => {
+    return await withWorkspaceSessionActivityRls(db, workspaceId, fn);
+  });
+}
+async function retryWorkspacePersistence(db, workspaceId, options, fn) {
+  return await runIdempotentPersistenceTransaction(options, async () => {
+    return await withWorkspaceRls(db, workspaceId, fn);
+  });
+}
+async function retryRlsPersistence(db, context, options, fn) {
+  return await runIdempotentPersistenceTransaction(options, async () => {
+    return await withRlsContext(db, context, fn);
+  });
+}
+async function withWorkspaceSubjectRls(db, workspaceId, subjectId, fn, transactionConfig) {
+  if (!subjectId.trim()) {
+    throw new Error("withWorkspaceSubjectRls: a non-empty subjectId is required");
+  }
+  const context = await rlsContextForWorkspace(db, workspaceId);
+  return await withRlsContext(
+    db,
+    context,
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, subjectId);
+      return await fn(scopedDb);
+    },
+    transactionConfig
+  );
+}
+async function withWorkspaceSubjectSessionActivityRls(db, workspaceId, subjectId, fn, transactionConfig) {
+  if (!subjectId.trim()) {
+    throw new Error("withWorkspaceSubjectSessionActivityRls: a non-empty subjectId is required");
+  }
+  const context = await rlsContextForWorkspace(db, workspaceId);
+  return await withSessionActivityRlsContext(
+    db,
+    { ...context, workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, subjectId);
+      return await fn(scopedDb);
+    },
+    transactionConfig
+  );
+}
+async function setSubjectRlsContext(db, subjectId) {
+  if (!subjectId.trim()) {
+    throw new Error("setSubjectRlsContext: a non-empty subjectId is required");
+  }
+  await db.execute(sql`select set_config('opengeni.subject_id', ${subjectId}, true)`);
+  const applied = await db.execute(
+    sql`select current_setting('opengeni.subject_id', true) as subject_id`
+  );
+  if ((applied[0]?.subject_id ?? "") !== subjectId) {
+    throw new Error("Authenticated subject RLS context was not applied on the active backend");
+  }
+}
+async function withWorkspaceUsageLock(db, workspaceId, fn) {
+  const context = await rlsContextForWorkspace(db, workspaceId);
+  return await withRlsContext(db, context, async (scopedDb) => {
+    await scopedDb.execute(sql`select pg_advisory_xact_lock(hashtext(${`usage:${workspaceId}`}))`);
+    return await fn(scopedDb);
+  });
+}
+async function withAccountRls(db, accountId, fn) {
+  return await withRlsContext(db, { accountId, workspaceId: null }, fn);
+}
+function dbBindingFor(db) {
+  return dbBindings.get(db);
+}
+
+export {
+  nestedPostgresSqlState,
+  databaseFailureCode,
+  isRetryablePersistenceSqlState,
+  isDatabasePersistenceFailure,
+  safeDatabaseErrorFacts,
+  SessionEventPersistenceError,
+  isSessionEventPersistenceError,
+  runIdempotentPersistenceTransaction,
+  rlsStrategyFor,
+  rawRows,
+  SandboxProviderReadLockUnavailableError,
+  withSandboxProviderReadLock,
+  createDb,
+  registerDbBinding,
+  setRlsContext,
+  withRlsContext,
+  withDatabaseStatementTimeout,
+  rlsContextForWorkspace,
+  withWorkspaceRls,
+  withSessionActivityRlsContext,
+  withWorkspaceSessionActivityRls,
+  withSessionActivitySavepoint,
+  retrySessionActivityRls,
+  retryWorkspacePersistence,
+  retryRlsPersistence,
+  withWorkspaceSubjectRls,
+  withWorkspaceSubjectSessionActivityRls,
+  setSubjectRlsContext,
+  withWorkspaceUsageLock,
+  withAccountRls,
+  dbBindingFor
+};
+//# sourceMappingURL=chunk-ISI2TIUG.js.map